Fix the cleanup handling in a error path for TCP BBR.

Reported by: syzbot+df7899c55c4cc52f5447@syzkaller.appspotmail.com Reviewed by: rscheff Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D25486
freebsd · Jul 1, 2020 · e54b7cd · e54b7cd
1 parent e4fc3b6
commit e54b7cd
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c
@@ -13381,6 +13381,8 @@ bbr_output_wtime(struct tcpcb *tp, const struct timeval *tv)
 					 */
 					BBR_STAT_INC(bbr_offset_drop);
 					tcp_set_inp_to_drop(inp, EFAULT);
+					SOCKBUF_UNLOCK(sb);
+					(void)m_free(m);
 					return (0);
 				}
 				len = rsm->r_end - rsm->r_start;